Sectors under Annex 1 BSIG
High criticality; depending on entity type and size, classification as an important or particularly important entity is possible.
- Energy
- Transport
- Finance
- Health
- Water
- Digital infrastructure
- Space
Check for free whether your organization may qualify as an important or particularly important entity under Germany's BSI Act.
No sign-in. Runs locally in your browser. Non-binding initial assessment, not legal advice.
The check assesses one legal entity by activity, size, and special rules. For corporate groups, linked enterprises may need to be included.
In Germany, sector alone is not decisive. The assessment starts with the specific entity type an organization actually operates. It then considers employee numbers, annual revenue, annual balance-sheet total, and statutory special cases.
The BSI Act distinguishes between important entities and particularly important entities. Both categories are subject to requirements including risk management, incident reporting, registration, and management responsibility.
This check simplifies the central criteria in § 28 and Annexes 1 and 2 BSIG. It cannot conclusively assess complex group structures, mixed activities, or sector-specific boundaries.
Our article explains what follows a possible classification, including NIS2 registration and subsequent duties.
A sound initial assessment follows a fixed sequence. Only the criteria taken together lead to a possible classification.
Which specific good or service does the organization provide?
Does that entity type appear in Annex 1 or Annex 2 of the BSI Act?
What employee and financial values result after including relevant partner and linked enterprises?
Do special classifications, exemptions, or overriding sector-specific rules apply?
Germany's implementation groups covered activities in Annexes 1 and 2 of the BSI Act. Within a sector, however, only the statutorily described activities and entity types are covered. A general sector association alone is therefore insufficient.
High criticality; depending on entity type and size, classification as an important or particularly important entity is possible.
Other critical sectors; covered entity types can qualify as important entities when the size criteria are met.
For many entity types, classification as an important entity may apply when there are at least 50 employees, or annual revenue exceeds €10 million and the annual balance-sheet total also exceeds €10 million.
For entity types in Annex 1, classification as a particularly important entity may generally apply when there are at least 250 employees, or annual revenue exceeds €50 million and the annual balance-sheet total also exceeds €43 million.
Partner and linked enterprises may need to be included when determining size. The law also provides different rules for certain providers. Do not use the thresholds in isolation as an exclusion criterion.
In Germany, companies and other entities may be covered when their specific activity matches an entity type in Annex 1 or 2 of the BSI Act and they meet the relevant size criteria. Special rules independent of the usual thresholds apply to some entity types.
Secani connects requirements, responsibilities, measures, and evidence in a traceable compliance workflow.
Status: 25 July 2026. Key sources include the BSI Act as amended, its Annexes 1 and 2, and the BSI publication on the NIS2 applicability assessment.